Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/09/2024, 18:47

General

  • Target

    2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe

  • Size

    4.8MB

  • MD5

    11a07ae5b1c0322d338b600969f36d0f

  • SHA1

    0b51fabe8a2bfff2dcbd13d4b0af7737c926e51f

  • SHA256

    f67c9eb3930de4c767f522915503ce71ea4dbf02a003f5d44d1261d5c0db8f0e

  • SHA512

    09268b1506524b10b02136bde864a66b93e44bb254179f2c6e3d5b792ba71decbd2f6c899682e88b6144193c8952dad8d9e308a7c016d2d28310a48776d3f56b

  • SSDEEP

    98304:+7IyvTgqJ/BZXxkIjPG1f5ehM/Cw/khc5FbKEQ26PVR7m6gZ1MRGNCyI5AxV300e:4bg6BZBkIAhehM/Cw/khc5FbKEV6PVRz

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 12 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 31 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-04_11a07ae5b1c0322d338b600969f36d0f_magniber_metamorfo.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Users\Admin\AppData\Local\Temp\{1BE17D05-5F16-4407-A7F8-556A08FA43C4}-TemporaryCache\KB931125.exe
      "C:\Users\Admin\AppData\Local\Temp\{1BE17D05-5F16-4407-A7F8-556A08FA43C4}-TemporaryCache\KB931125.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2768
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        PID:2588
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        PID:2948
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        PID:2716
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2828
    • C:\Users\Admin\AppData\Local\Temp\{173EE89B-7DDE-44f4-B7C9-65D226E18002}-TemporaryCache\KB931125.exe
      "C:\Users\Admin\AppData\Local\Temp\{173EE89B-7DDE-44f4-B7C9-65D226E18002}-TemporaryCache\KB931125.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1536
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        PID:1972
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        PID:2104
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1348
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF16.DLL

    Filesize

    2KB

    MD5

    7210d5407a2d2f52e851604666403024

    SHA1

    242fde2a7c6a3eff245f06813a2e1bdcaa9f16d9

    SHA256

    337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af

    SHA512

    1755a26fa018429aea00ebcc786bb41b0d6c4d26d56cd3b88d886b0c0773d863094797334e72d770635ed29b98d4c8c7f0ec717a23a22adef705a1ccf46b3f68

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF32.DLL

    Filesize

    4KB

    MD5

    88d01717dc4f1119ea925ff0217c5f49

    SHA1

    7da9c2e12283800f9896c1f15f789539529e00ec

    SHA256

    c6407f5792a945bf0948de191e6c54c4fbd2abcc0af3994140fb4319f685dbbd

    SHA512

    39ecd9d2bb8b4edf88b8882640ec49c061fa34496c026ad19adf4bc4462de3949c72ad00bcc2ca27d53596221c026e978f875bb6cf7e0e8c2d884c1d37a83781

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\authroots.sst

    Filesize

    73KB

    MD5

    bb49ccc10926cdb601eba81afef749a2

    SHA1

    a4766c9aea8d211e9632148fd4b625cece195be9

    SHA256

    f013ee3b7fede9a95844e83e83ee298d38cba6efce5a5cafcd8b95255c32f86c

    SHA512

    94c2809727039d1ed07a3742a4b2f9300e865ea7c49bc1fcf547a30238eeecc88d8dd06a2d4f3112317f948908b9af082b50f412a41a2bcb48d5e30d6d8ecbba

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\delroots.sst

    Filesize

    9KB

    MD5

    7b32871e409608ff887b6cf4d87debb0

    SHA1

    191f9ea1298ee52dbd6f977b3584109a064f57b9

    SHA256

    3f01268547364d2d60a0f65b46757cccfd9225fc39d581846a8fbffdb5756ff2

    SHA512

    534a384f7946db4083e639b8e02d83ac97293c60630b8811a84c85e0330e9c293f05f5cf71e0f3580551e7923bc5a3bfb7f0406432ca3cdb7efeb4a950ac5e8a

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\roots.sst

    Filesize

    7KB

    MD5

    9e5de0fd1f90486a66dee4bfe89a78d7

    SHA1

    90e3188ef63495aaa71c85d4ff0f23253c834b40

    SHA256

    8b95ff56d61586582864d05563762615c8705779578dca3c98a303c3b1f4122e

    SHA512

    60006fa6f57e4d280642d51055f85f8d27b913ce71373de5b928c515c77647295030ab73ab4a55024de4a40c18f200909f49ffb52c26cf554835fc3d4cc348f1

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rootsupd.inf

    Filesize

    1KB

    MD5

    421e60325404f5f29ac04c9b9d59096b

    SHA1

    aace2fd74d799e8af5c8d5b2646361bb67a1620c

    SHA256

    571a8da5298aacc37700c747ee5d72b5a7797835140e7a4d4f895e9604574d77

    SHA512

    86693975b1b187ee65b0a23b1f3f8e05d1a3f61e7e47b060f938fe1602bbad96021847b709e64c2d5a295b72f10f4db587a11a1e7ca0a0b64c3bed7fa683b1d2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

    Filesize

    5KB

    MD5

    9c18ae971cbffb096952177f6804ea31

    SHA1

    bb255dd1bd9bb39cdbb8671af66054432c686828

    SHA256

    2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

    SHA512

    21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.sst

    Filesize

    320KB

    MD5

    2d9b4498c847715418160bfd7e7c8a2d

    SHA1

    e0873091d476d2566aa6fc988cb364247c95dc97

    SHA256

    c49c05b701c390c679e5e3226ec621f22a08155b1065fcfc37b509f648f03b41

    SHA512

    dcf3208cdd1e4353f82823f796d735c1209f149f183eea827a90753ec55509a1c460a16c120e07c12a5eacf0e67d2661c25638491ecf4403e25d6508983e519b

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

    Filesize

    89KB

    MD5

    a64e4b204d44548eeb5c3d86eca2ad70

    SHA1

    e3245bf6dbb2e56d71a9cbad2697aa4fa0df6bbe

    SHA256

    985a5603ebf94539ac11549999f83b5e6dc008180994898c5daa6fd31ae1e9dc

    SHA512

    dca4099318954bab5f1204645be0d0e8fea0c2e97ee95496fa884fbed627e376358623fa94c39bf0abe97d07d46a7e6c5e1081496cdd1987e07e595995a46cd5

  • \Users\Admin\AppData\Local\Temp\{1B5017E3-F4ED-4a6c-9F6C-B16552B8A411}-TemporaryCache\7z.dll

    Filesize

    1.1MB

    MD5

    f0fef6362d4886e85a186a5e3766650a

    SHA1

    65843b7052a4d1b84762479d79445c46834e18b5

    SHA256

    15b9fe7d408cbf2204039087526e7df947df57b42ea479e303b682e956638816

    SHA512

    3f6dfd701cf62b77219f8825a2257c4bd7d44ebafc5654b06abaf906ced2571f4eeb04fe22ae6136c14bddebddb12555aa6efd322e779443d57bb122ea786043

  • \Users\Admin\AppData\Local\Temp\{1BE17D05-5F16-4407-A7F8-556A08FA43C4}-TemporaryCache\KB931125.exe

    Filesize

    349KB

    MD5

    4a4d72d34f9da1fc5019e0748fcde2f5

    SHA1

    f54752ec63369522f37e545325519ee434cdf439

    SHA256

    83b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca

    SHA512

    95986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33